We see the stories in the news each and everyday.
Malware hit Android. Malware took advantage of known flaws in Windows. Source code was released for a new family of malware. The thing is … none of this is really news.
I’ll make it simple for you. You can ignore all the rest of the malware stories that come out this year if you remember the following points:
- Attackers get better day-by-day. After all, if they didn’t, they’d lose.
- As defenders, you must also get better day by day. If you don’t, you’ll lose.
- Since we can’t control what the attackers do, the best you can do is play to not lose. This means:
1) Harden your systems (patch them, check users/passwords, remove uneeded software).
2) If you can’t harden your systems, get rid of them.
3) If you can’t harden your systems or get rid of them, implement compensating controls and understand where the gaps leave you exposed.
4) If you can’t do any of these three, get help. Sorry to toot my own horn here, but this is what we specialize in. You don’t need to be perfect, you just have to be getting better a bit faster than the attackers do.
5) If you can’t get help, give up. Just post your banking credentials, customer list and passwords on your website. The attackers are going to get them anyway. If you’re not going to protect yourself, just give up and enjoy the ride down as best you can.